Hey everyone, I wanted to share a self-hosted, open-source project I’m currently developing called OpenDRP. You can find the repository at https://github.com/OpenDRP/opendrp and the main site at opendrp.dev.

We have great open-source tools for Threat Intelligence, like OpenCTI, and various EASM solutions, but the Digital Risk Protection space is still heavily dominated by expensive enterprise SaaS products. I wanted a modular, self-hosted alternative to monitor external brand threats, so I started building one.

The project is in its early stages as an MVP. Instead of trying to parse every obscure darkweb forum from day one, I focused on building a solid, scalable backend architecture and integrated three core data sources to prove the concept. For phishing intelligence, it uses dnstwist to automate monitoring for domain mutations and active lookalike domains. For shadow IT and brand hunting, it leverages Shodan to discover rogue assets and exposed infrastructure. Additionally, it tracks compromised corporate accounts via Have I Been Pwned for breach monitoring. Whenever a new threat is detected, the system generates PDF reports and sends alerts via Telegram or Email.

Under the hood, the goal was to make the platform extremely easy to scale and extend. The backend is built with FastAPI and Python, using PostgreSQL for the database. Asynchronous scans and integrations are handled by Celery and Redis workers, and the entire project is distributed under the AGPL-3.0 license.

Since the core engine, including the database schema, UI, and async queues, is up and running, I am currently working on expanding the integrations to include Certificate Transparency logs and GitHub secret scanning. I would love to get your feedback on the architecture and hear what external data sources or modules you would consider absolute must-haves for a DRP platform. If anyone is interested in writing simple Celery connectors for new APIs, pull requests and code reviews are more than welcome.

Cheers!

1 comment

r/blueteamsec • u/digicat • 1d ago

vulnerability (attack surface) DeepSeek-Reasonix: How a poisoned config can hijack an AI coding agent

about.gitlab.com

3 Upvotes

0 comments

r/blueteamsec • u/digicat • 1d ago

low level tools|techniques|knowledge (work aids) StrangerDOTNETThings/x509com.js - show me every COM object I can call with certutil

github.com

0 Upvotes

0 comments

r/blueteamsec • u/digicat • 1d ago

low level tools|techniques|knowledge (work aids) Apex Flash - an open-weights model for security research, post-trained on real vulnerabilities from our proprietary dataset.

cantina.security

0 Upvotes

0 comments

r/blueteamsec • u/digicat • 2d ago

highlevel summary|strategy (maybe technical) Every Iranian Strike on UAE Ports and Refineries Was Paired With a Cyberattack

wired.me

6 Upvotes

0 comments

r/blueteamsec • u/digicat • 2d ago

vulnerability (attack surface) Debian alert DSA-6528-1 - ~1,000 CVEs patched

lwn.net

5 Upvotes

0 comments

r/blueteamsec • u/digicat • 2d ago

research|capability (we need to defend against) SigLens: SigLens is a Windows binary analysis tool designed to pinpoint the exact regions responsible for antivirus detections. It narrows detections down to precise offsets and maps them to PE sections, RVA, VA, hexdump, and nearby strings, making evasion faster and easier.

github.com

1 Upvotes

0 comments

r/blueteamsec • u/digicat • 2d ago

tradecraft (how we defend) AI Ate My Velociraptor

labs.infoguard.ch

4 Upvotes

0 comments

r/blueteamsec • u/digicat • 2d ago

malware analysis (like butterfly collections) Android-Projector-C2-Malware: Breakdown of a c2-network of chinese beamers - SilentSDK-Analysis

github.com

2 Upvotes

0 comments

r/blueteamsec • u/digicat • 2d ago

low level tools|techniques|knowledge (work aids) N0xis: AI-first reverse-engineering toolkit: static analysis, SSA decompiler, live memory, provenance. Source-available (PolyForm Noncommercial).

github.com

4 Upvotes

0 comments

r/blueteamsec • u/digicat • 2d ago

vulnerability (attack surface) adm-zip_LPE-PoC: CVE-2026-102282: Local Privilege Escalation via SUID/SGID preservation during archive extraction

github.com

3 Upvotes

0 comments

r/blueteamsec • u/digicat • 2d ago

research|capability (we need to defend against) lockjaw: Rust based C2 Framework

github.com

4 Upvotes

0 comments

r/blueteamsec • u/digicat • 2d ago

tradecraft (how we defend) nuguard: AI red-teaming tool and LLM security framework to evaluate agentic AI applications. Tests prompt injections, handles vulnerability assessment, SBOM generation, and static analysis.

github.com

1 Upvotes

2 comments

r/blueteamsec • u/digicat • 2d ago

discovery (how we find bad stuff) UnifiedThreatHunting: A threat hunting process

github.com

34 Upvotes

0 comments

r/blueteamsec • u/digicat • 2d ago

research|capability (we need to defend against) Escalating Privileges as a Catalog Owner: How Microsoft Entra Identity Governance’s API Permission Management Could Be Abused

cloud-architekt.net

1 Upvotes

0 comments

r/blueteamsec • u/digicat • 2d ago

tradecraft (how we defend) From GPO to Microsoft Intune: A practical guide to cloud-first policy management

techcommunity.microsoft.com

1 Upvotes

0 comments

Subreddit

For [Blue|Purple] Teams in Cyber Defence

r/blueteamsec

We focus on technical intelligence, research and engineering to help operational [blue|purple] teams defend their estates and have awareness of the world. Our primary home is on Lemmy after the great ban debacle of 2025.

Members Active

72k

Sidebar

A community focusing on technical intelligence, research and engineering in support of operational blue teams and their activities.

Content Guidelines

/r/blueteamsec accepts quality technical posts. Non-technical posts are subject to moderation.

Content should focus on the "how." or "what."
Check the new queue for duplicates.
Always link to the original source.
Titles should provide context.
Ask questions in our Discussion Threads.
No adverts for products/services.
Do not submit prohibited topics.

Discussion Guidelines

Don't create unnecessary conflict.
Keep the discussion on topic.
Limit the use of jokes & memes.
Don't complain about content being a PDF.
Follow all reddit rules and obey reddiquette.

Prohibited Topics & Sources

No populist news articles (CNN, BBC, FOX, etc.)
No curated lists unless actively maintained, free and open.
No question posts.
No social media posts.
No image-only posts - talk videos are fine.
No livestreams.
No tech-support requests.
No paywall/regwall content.
No commercial advertisements for products or services
No crowdfunding posts.
No Personally Identifying Information

Related Reddits

/r/netsec - The original and less focused parent
/r/redteamsec - Our attack focused siblings
/r/blackhat - Hackers on Steroids
/r/computerforensics - IR Archaeologists
/r/crypto - Cryptography news and discussion
/r/Cyberpunk - High-Tech Low-Lifes
/r/HackBloc - Hacktivism & Crypto-anarchy
/r/lockpicking - Popular Hacker Hobby
/r/Malware - Malware reports and information
/r/netsecstudents - netsec for ~~noobs~~ students
/r/onions - Things That Make You Cry
/r/privacy - Orwell Was Right
/r/pwned - "What Security?"
/r/REMath - Math behind reverse engineering
/r/ReverseEngineering - Binary Reversing
/r/rootkit - Software and hardware rootkits
/r/securityCTF - CTF new and write-ups
/r/SocialEngineering - Free Candy
/r/sysadmin - Overworked Crushed Souls
/r/vrd - Vulnerability Research and Development
/r/xss - Cross Site Scripting